Rebind By Remote

Atomically move an active binding from its current workspace to a new one.

Holds a row-level FOR UPDATE lock on the existing binding for the duration of the transaction so two concurrent PUTs against the same remote serialize cleanly. When expected_current_datamate_id is provided, it must equal the currently-bound workspace's id or the swap is rejected with 412 (optimistic concurrency); when absent, the swap is unconditional — the caller is explicitly opting into last-writer-wins.

Authorization: BOTH the source and the target workspace must be owned by the caller. Without the source-side check, any tenant user could re-point another user's project binding at their own workspace. The row is mutated in place rather than delete+insert; created_at keeps reflecting the original binding.